Newsletters: Newsbites

SANS NewsBites is a semiweekly high-level executive summary of the most important news articles that have been published on computer security during the last week. Each news item is very briefly summarized and includes a reference on the web for detailed information, if possible.

Spend five minutes per week to keep up with the high-level perspective of all the latest security news. New issues are delivered free every Tuesday and Friday.

Volume X - Issue #28

April 08, 2008

It's very rare that we highlight a blog in NewsBites, but one posted last night, by Mary Ann Davidson of Oracle, tells of the first important development in the long quest to persuade college faculty to teach secure coding in their core curriculum. No other software company has done anything nearly as important in this arena as what Oracle has done. Her blog is at http://blogs.oracle.com/maryanndavidson/ (April 8) See the first story in this issue for more.

Are your internal controls and acceptable use policies for consultants, temporary, and high-risk users working? What information assets are in jeopardy? Find the facts, blind spots and new technology regarding real-time visibility and control of network user transactions. Download the FREE whitepaper "TRUST BUT VERIFY: 24/7 Monitoring of High-risk User Activity in the Network" now.http://www.sans.org/info/27198

TOP OF THE NEWS

Oracle Takes the Lead In Encouraging Secure Coding Training In US Colleges (April 8, 2008)

Oracle's Chief Information Security Officer, Mary Ann Davidson, posted blog last night heralding the first important step in improving secure coding education in US colleges and universities. Here is an excerpt: "Last year, I got fed up enough with Oracle having to train otherwise bright and capable CS grads in secure coding 101 that I sent letters to the top 10 or so universities we recruit from. . . Specifically, we sent the letters to the chairmen of the department of computer science (or equivalent) and copied the deans of the schools with oversight of the CS departments. In the letter, we stated that Oracle expends significant resources training CS graduates in secure coding practices. We described the impact to us and to our customers of avoidable, preventable security defects, and why the insecurity of commercial software is a national security problem. . . . And we stated that in the future, Oracle would give preference in hiring to those universities that emphasize secure coding practices."-http://blogs.oracle.com/maryanndavidson/

Oracle's letter is posted at -http://www.oracle.com/security/docs/mary-ann-letter.pdf[Editor's Note (Paller): The tests are now ready (www.sans.org/gssp); programmers can easily prove mastery of the basics. Faculty from many colleges are meeting next month to agree on exercises and other tools for embedding security in existing CS and programming courses. Maybe colleges are going to become leaders in helping programmers write code with fewer security flaws. If you hire more than a few programmers each year, please consider lending your voice to the growing chorus of employers asking colleges to make sure their graduates have the basics of secure coding. And when you send your letters, please share them so that faculty understand this is a national need they cannot ignore. ]

ISPs Conducting Deep-Packet Inspection (April 4, 2008)

The Internet use of at least 100,000 Americans is being monitored by ISPs. They collect the information so users can be targeted with advertisements that are more likely to be of interest to them and advertisers are likely to reach a more receptive audience. The companies involved in what is known as deep-packet inspection maintain that users' privacy is protected because personally identifying information is not shared. -http://www.washingtonpost.com/wp-dyn/content/article/2008/04/03/AR2008040304052_pf.html[Editor's Note (Schultz): You've got to be kidding. _Animal Farm_, here we come. (Northcutt): These practices are far more pervasive than most people understand. Here is a research note I keep on SANS college's Security Laboratory to keep track of this very disturbing trend: -http://www.sans.edu/resources/securitylab/superclick_privacy.php(Liston): This is the practice that has caused an uproar over Phorm (see "Phorm Targeted Advertising Plan Comes Under More Fire" elsewhere in NewsBites). What I find interesting is that the privacy implications of these systems aren't anything new: your browsing data has been traversing your ISP's network in the clear and subject to this type of analysis all along. Now that they're admitting to analyzing it, suddenly it's a privacy concern? ]

(1) With Rapid7 NeXpose, you can detect, report and remediate vulnerabilities throughout their entire network. Whether you want a "plug and play" appliance, downloadable software or an external hosted service, with NeXpose, you are assured your network, databases and web applications are free from vulnerabilities. http://www.sans.org/info/27203

2) SANS Third Annual Log Management Survey What are the challenges in log management? Have perceptions changed since last year? Help us find out! Take the survey at http://www.sans.org/info/27208

THE REST OF THE WEEK'S NEWS

LEGAL MATTERS

University of Oklahoma (OU) student Jose Antonio Roman has been charged with violating the Oklahoma Computer Crimes Act. Roman allegedly broke into other OU students' email and Facebook accounts and changed the passwords, locking them out of their own accounts. Roman allegedly obtained the information necessary to access the accounts by scanning the local OU subnet from his dorm room. He also allegedly launched a number of Address Resolution Protocol (ARP) poisoning attacks late last year. -http://www.normantranscript.com/localnews/local_story_093235818.html-http://www.koco.com/news/15795801/detail.html

HOMELAND SECURITY & GOVERNMENT SYSTEMS SECURITY

A National Institutes of Health (NIH) agency memo forbids employees from storing sensitive data on MacBook laptop computers. As of April 4, all NIH laptops running Windows or Linux operating systems must have the Pointsec encryption tool; Windows Vista users may also use that operating system's BitLocker disk encryption tool. There is presently a beta version of Pointsec for MacBooks, but not an approved version. The ban on MacBooks holding sensitive data applies to contractors as well as in-house employees. -http://www.informationweek.com/shared/printableArticle.jhtml?articleID=207001840-http://www.fcw.com/online/news/152173-1.html[Editor's Note (Schultz): As said so many previous times, nothing serves as a wake-up call for security as much as a serious security-related incident. (Liston): Note: The issue here is the lack of an approved version of whole-disk encryption, not with OSX itself. Apple Fanboys: Return to standby. Nothing to see here-- you may safely return to caressing your MacBooks and iPhones. (Frantzen): Those reading this might conclude Apple OS X has no disk encryption available. That's untrue: Macs come with FileVault out of the box since OS X 10.3 . It can be used to encrypt whole disks or virtual disks that can be mounted where you want them. ]

WORMS, ACTIVE EXPLOITS, VULNERABILITIES & PATCHES

Kraken Botnet Twice as Large as Storm (April 7, 2008)

The Kraken botnet is believed to be more than twice the size of the Storm botnet. Just 20 percent of antivirus (AV) packages are presently detecting Kraken, which comprises more than 400,000 zombie machines; Kraken is hard to detect because its code morphs. Researchers are still trying to determine how Kraken works its way into apparently well-fortified systems. One known technique it uses is to copy itself to infected computers' hard drives in an altered form that can be used to reinfect the machine if AV programs are eventually able to identify the original file. The Kraken botnet is used primarily to send spam. Internet Storm Center: -http://isc.sans.org/diary.html?storyid=4256-http://isc.sans.org/diary.html?storyid=4250-http://www.theregister.co.uk/2008/04/07/kraken_botnet_menace/print.html

ActiveX Control Flaw in Symantec Products (April 4, 2008)

Symantec has acknowledged that flaws in an ActiveX control that ships with many of the company's security software products could allow attackers to take control of vulnerable computers. The flaws are in the ActiveX control, SymAData.dll, and allow arbitrary code execution with the privileges of the currently logged in user. Symantec says that to exploit the flaws, attackers would need to launch cross-site scripting or DNS poisoning attacks. SymAData.dll is used by Symantec's AutoFix tool. Users engaging in an online chat session with Symantec Technical support will have an updated version of the tool installed automatically; others can download and install an updated version of the tool, from Symantec's website. -http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9074979&source=rss_topic17[Editor's Note (Schultz): Because of the lack of security in ActiveX, any credible security vendor should not rely on any ActiveX control for any security-related capability--end of story. ]

ATTACKS, INTRUSIONS, DATA THEFT & LOSS

Lost Disk Holds Data on 370,000 HSBC Customers (April 7, 2008)

The UK's Financial Services Authority will investigate the loss of a disk containing personally identifiable information of 370,000 HSBC customers. The compromised data include names, dates of birth, and life insurance information, but no bank account information. The disk was being sent from HSBC to a reinsurance firm. The disk was not encrypted. Normally, the data are transferred electronically, but because the system was down, HSBC sent the information on disk through the post. -http://www.vnunet.com/vnunet/news/2213667/hsbc-lose-370-customer-details-http://www.theregister.co.uk/2008/04/07/hsbc_disc_loss/print.html[Editor's Note (Liston): Ok, so during the whole time that they were trying to figure out how to get the data from point A to point B when the normal system was down, during the time they were writing it out to disk, during the time they were finding an envelope and figuring out who to send it to, no one thought to ENCRYPT it? (Honan): I sincerely hope that the Financial Services Authority, which recently fined the Nationwide Building Society UK 980,000 for losing a laptop, and the UK Information Commissioner's Office deal with this with the seriousness it deserves. ]

Pfizer Data Security Breach (April 7, 2008)

Pfizer has experienced another data security breach. A laptop stolen from a contractor's home contains personally identifiable information of approximately 800 current and former Pfizer employees and contractors. The data include names, credit card numbers, and card expiration numbers. The theft occurred on February 7, 2008; an incident notification letter the company sent to attorneys general in several states was dated March 19. In 2007, Pfizer suffered four data security breaches that compromised personally identifiable information of more than 52,000 individuals. -http://www.theday.com/re.aspx?re=6b8c60cf-8fa2-43f1-9238-6dba8792cfa3

Known Flaws Not Patched on Breached Antioch Univ. System (April 4, 2008)

Antioch University's data security breach has been attributed to a Sun Solaris server FTP vulnerability that had not been patched, despite the fact that there was a fix available before the intrusion. The attackers breached the ERP server on three occasions in 2007; however the breaches were not detected until February 2008, however, when university IT officials were investigating different malware that was causing the system to send out offensive content. At that time, they found an IRC bot installed on the server. Antioch University CIO William Marshall says there is no evidence that any data on the server were downloaded or copied. -http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9075098&source=rss_topic17[Editor's Note (Schultz): Sorry, but when someone says "there is no evidence that" when all the appearances of a security-related incident exist, that person has reduced credibility because of how easy it is to overlook such an incident. ]

Gene Schultz On Using SIEMs to Detect Attacks

The latest Security Thought Leadership interview is with Dr. Gene Schultz of High Tower. Gene, a well known security researcher with a focus on intrusion detection shares his thoughts on security, governance and in particular using a SIEM to detect attacks: -http://www.sans.edu/resources/securitylab/gene_schultz.php

This webcast is an eight minute information packed remix of an earlier webcast. Grab the slides, click on the YouTube link and you are good to go. The goal is to get you the information you need as quickly as possible. Learn the core reasons for web vulnerabilities and how you can test for them. We would love to hear your thoughts about this experiment, drop us a note with your comments, stephen@sans.edu The video of the webcast redux is live on youtube.com

This monthly webcast discusses recent threats observed by the Internet Storm Center, and discusses new software vulnerabilities or system exposures that were disclosed over the past month. The general format is about 30 minutes of presentation by senior ISC staff, followed by a question and answer period.

A need to meet the vague requirements of FISMA compliance prompted Lockheed to look for a new log management product to replace a recently acquired tool with one more suited to its manpower and skill level requirements. The company found a solution that had lower total cost of ownership, could process all logs and had correlation capabilities to show attack indicators.

Please join Eric Cole for a discussion of how to keep your information systems in check as the vulnerability landscape rolls out around you with this free webcast: "Find and Fix Security Exposures before You're in a Heap of Trouble"

During the webcast, Eric will examine the technologies available for assessing both the security of your network systems and the effectiveness of the defenses meant to protect them.

This webinar will discuss the challenges associated with NAC deployments and provide organizations with a blueprint on how to cost-effectively take advantage of this critical technology. Learn first hand how your organization can benefit from this ground-breaking technology.

******************************************************************* Be sure to check out the following FREE SANS archived webcasts:

Eugene Schultz, Ph.D., CISM, CISSP is CTO of High Tower Software and the author/co-author of books on Unix security, Internet security, Windows NT/2000 security, incident response, and intrusion detection and prevention. He was also the co-founder and original project manager of the Department of Energy's Computer Incident Advisory Capability (CIAC).

John Pescatore is Vice President at Gartner Inc.; he has worked in computer and network security since 1978.

Stephen Northcutt founded the GIAC certification and currently serves as President of the SANS Technology Institute, a post graduate level IT Security College, www.sans.edu.

Howard A. Schmidt served as CSO for Microsoft and eBay and as Vice-Chair of the President's Critical Infrastructure Protection Board.

Ed Skoudis is co-founder of Intelguardians, a security research and consulting firm, and author and lead instructor of the SANS Hacker Exploits and Incident Handling course.

Tom Liston is a Senior Security Consultant and Malware Analyst for Intelguardians, a handler for the SANS Institute's Internet Storm Center, and co-author of the book Counter Hack Reloaded.

Dr. Eric Cole is an instructor, author and fellow with The SANS Institute. He has written five books, including Insider Threat and he is a senior Lockheed Martin Fellow.

Bruce Schneier has authored eight books -- including BEYOND FEAR and SECRETS AND LIES -- and dozens of articles and academic papers. Schneier has regularly appeared on television and radio, has testified before Congress, and is a frequent writer and lecturer on issues surrounding security and privacy.

Mason Brown is one of a very small number of people in the information security field who have held a top management position in a Fortune 50 company (Alcoa). He is leading SANS' global initiative to improve application security.

Marcus J. Ranum built the first firewall for the White House and is widely recognized as a security products designer and industry innovator.

Mark Weatherford, CISSP, CISM, is the Chief Information Security Officer for the State of Colorado.

Alan Paller is director of research at the SANS Institute

Clint Kreitner is the founding President and CEO of The Center for Internet Security.

Rohit Dhamankar is the Lead Security Architect at TippingPoint, a division of 3Com, and authors the critical vulnerabilities section of the weekly SANS Institute's @RISK newsletter and is the project manager for the SANS Top20 2005 and the Top 20 Quarterly updates.

Koon Yaw Tan is Assistant Director at Monetary Authority of Singapore (MAS) and a handler for the SANS Institute's Internet Storm Center.

Gal Shpantzer is a trusted advisor to several successful IT outsourcing companies and was involved in multiple SANS projects, such as the E-Warfare course and the Business Continuity Step-by-Step Guide.

Brian Honan is an independent security consultant based in Dublin, Ireland.

Roland Grefer is an independent consultant based in Clearwater, Florida.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit http://portal.sans.org/